Strix
26.1K

CVE-2014-8765

UnknownEPSS 1.16%

Last modified

CVE-2014-8765 is a vulnerability of currently unknown severity. Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the "manage PIFR environments" permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page.. EPSS estimates a 1.16% chance of exploitation in the next 30 days.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the "manage PIFR environments" permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page.

Metrics

EPSS Probability
1.16%

63.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
DrupalProject Issue File Review<= 6.x-2.16
DrupalProject Issue File Review6.x-2.00
DrupalProject Issue File Review6.x-2.01
DrupalProject Issue File Review6.x-2.02
DrupalProject Issue File Review6.x-2.03
DrupalProject Issue File Review6.x-2.04
DrupalProject Issue File Review6.x-2.05
DrupalProject Issue File Review6.x-2.06
DrupalProject Issue File Review6.x-2.07
DrupalProject Issue File Review6.x-2.08
DrupalProject Issue File Review6.x-2.10
DrupalProject Issue File Review6.x-2.12
DrupalProject Issue File Review6.x-2.13
DrupalProject Issue File Review6.x-2.14
DrupalProject Issue File Review6.x-2.15

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2014-8765?
Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the "manage PIFR environments" permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page.
How severe is CVE-2014-8765?
Severity scoring for CVE-2014-8765 is pending analysis. The EPSS model estimates a 1.16% probability of exploitation in the next 30 days.
How do I fix CVE-2014-8765?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-8765?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST